Endpoint Protection

...when I add the client and manually by either pushing it from the SEPM manager or via the Client Deployment tool, clients will update.

I have created a group specifically for the purpose of upgrading. I add all of the pacakages for 32 and 64 bit systems and I think one mistake I made was letting it run only for one day, I have now changed that to 365 days hoping it would make a difference. I still notice though that doing it this way only works on occasion, and some clients NEED to have me manually push the package via the client deployment tool.

Any ideas why this may be happening?

Have you just tried to re-starting the client? Or doing an smc -stop/start?

Did you try unchecking the schedule over all?

Well, since we no longer have the ability to restart SEP services, it's kind of off the table. I would have to log in and do the smc -stop.

In my opinion, there is a considerably large hole in remote support for Symantec. I like doing things without users interuption. It's not too viable to do such now.

I have not designated any scheduled times, it is set to go anytime.

You can use psexec to remotely restart smc but yes, not ideal. Be nice to be available from the SEPM.

That's a pretty good idea.

Where is the path to the SMC? I really don't want to type out

psexec \\PCNAME  "c:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin64"

yep thats it

C:\Program Files\Symantec\Symantec Endpoint Protection\<version>\Bin

This is interesting. When I pushed the package, ALL of the client installation files are sitting in the TEMP directory, but they are NOT executing. They are just parked there doing nothing.

Is there a SEP_INST.log file as well?

Not in that directory, let me dig

Check %temp%

Got a CMC error.

in the log or when trying to upgrade? Screenshot?

Out of disk space on one. To be continued.

If I do that, I will probably end up eating too much bandwidth, these machines are in multiple sites. I think I will move the machines back to their respective sites and test drive your "0" suggestion.

My initial recommendation is to change the "Distribute Upgrades over X days" to zero days.  This will tell clients in the group to download and install the upgrade immediately (or within the download randomisation window for the group), once they check in and pick up the new group/policy serial number.

#EDIT#

Leaving it on the default "Distribute Upgrades over 1 days", means that each client in the group will pick a random time within the next 24 hours to run the upgrade.  If they miss their time slot, then they have to wait until the schedule refreshes before trying again (i.e. try again the next day if distributing over 1 day, next week if the SEPM is distributing over 7 days, and so on)

I changed it to 365 days

Personally, I stopped using this option long ago. I only suggested smc -stop/start because it seemed to work when the client wouldn't upgrade for some reason. This seemed to kick it into action right away. And yes, bandwidth to remote sites was issue.

So with me putting it to 365, they will  have 365 chances to get the upgrade :-)

SEP 14 should be out by than!

Don't forget you can use this uprade function with the ability to host an installation package on any ol' webserver.

This means if you have an IIS box on any remote site, you can point the clients in that site to their local IIS box for the upgrade package instead of the SEPM (see below articles)

http://www.symantec.com/docs/TECH96873
http://www.symantec.com/docs/TECH97406
There's a win2k8 one somewhere too but can't find it for the life of me

As per my earlier post, changing the option to "Distribute Upgrades over 365 days" means that the clients in the group will install the the upgrade at a random point over the next 365 days.

If they miss this time slot, they will have to wait until the current schedule expires (so 2nd July 2014) before then picking a new random time slot in the next 365 days for the install.

This actually means they will have once chance every 365 days

I feel like I am in Bizarro world. OK.

As a quick update, here're some articles that describe what the "Distribute Upgrades over X days" option does:

http://www.symantec.com/docs/TECH97073
http://www.symantec.com/docs/TECH179006

Oh, I think the below bits got lost in the mulitple post updates.  Not sure if you've seen these before, but very useful if upgrading clients in remote sites:

Don't forget you can use this uprade function with the ability to host an installation package on any ol' webserver.

This means if you have an IIS box on any remote site, you can point the clients in that site to their local IIS box for the upgrade package instead of the SEPM (see below articles)

http://www.symantec.com/docs/TECH96873
http://www.symantec.com/docs/TECH97406
There's a win2k8 one somewhere too but can't find it for the life of me